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Top Stories 

• Local utility services reported power outages across 169,800 homes and businesses due to 
severe storms across Louisiana, Texas, Arkansas, Oklahoma, and Mississippi May 25. - 
Reuters (See item 1) 

• The No. 137 sweet crude unit and a related vacuum distillation unit at the Philadelphia 
Energy Solutions Inc., refinery were both shut down May 22 following a fire that was 
contained within an hour and resulted in no injuries. - Reuters (See item 4 ) 

• The Governor of Texas declared disasters in 37 counties after major flooding and high 
waters followed severe storms in Southeast Texas May 25 - 26. - USA Today (See item 

11 ) 

• Officials reported May 25 that internet and telephone services were restored after a water 
main break in Boston flooded critical equipment that caused an outage for approximately 
10,000 customers. - Springfield Republican (See item 29 ) 
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Energy Sector 



1. May 26, Reuters - (National) Storm leaves 170,000 without power in U.S. Gulf 
Coast. Local utility services reported power outages across 169,800 homes and 
businesses due to severe storms across Louisiana, Texas, Arkansas, Oklahoma, and 
Mississippi May 25. Power companies in Texas released that most customers would 
have power restored May 26, but would not be able to resume service in flooded areas 
until waters recede and damages can be assessed. 

Source: http://www.reuters.com/article/2015/05/26/utilities-power-outages- 
idUSLlN0YH0Q120150526 

2. May 23, Associated Press - (California) Pipeline that leaked wasn’t equipped with 
auto shut-off. Santa Barbara County officials reported that the pipeline that leaked 
105,000 gallons of crude oil into a culvert and spilled up to 21,000 gallons into the 
ocean at Refugio State Beach May 19 is the only major pipeline in the U.S. that does 
not have an auto-shut off feature. Plains All American Pipeline continued to drain the 
pipe and investigate the source of the leak over the weekend of May 23. 

Source: http://www.sunherald.com/2015/05/23/6242674 pipeline-that-leaked-wasnt- 
equipped.html?rh=l 

3. May 22, Reuters - (Texas) EPA says Citgo Corpus Christi plant agrees to line, fix 
problems. The U.S. Environmental Protection Agency announced May 22 that Citgo 
Petroleum Corp agreed to pay a $360,000 civil penalty and would address violations 
found in a 2012 inspection regarding equipment and controls, operation and auditing 
procedures, and initial and ongoing training at the company’s Corpus Christi refinery. 
Citgo also agreed to give $117,000 to the Corpus Christi Fire Department for 
equipment to detect and identify chemical leaks. 

Source: http://www.reuters.com/article/2015/05/22/refinerv-epa-citgo-pete- 
idUSLlN0YDlNP201 50522 

4. May 22, Reuters - (Pennsylvania) Fire hits Philadelphia refinery, shutting biggest 
crude unit. The No. 137 sweet crude unit and a related vacuum distillation unit at the 
Philadelphia Energy Solutions Inc., refinery were both shut down May 22 following a 
fire that was contained within an hour and resulted in no injuries. Plant officials have 
not released details on the damages or a timeline for when the crude and vacuum 
distillation unit will return online. 

Source: http://www.reuters.com/article/2015/05/23/us-refinery-operations- 
philadelphiaenerg-idUSKBN0Q8001 20150523 

For additional stories, see items 28 and 32 
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Chemical Industry Sector 

See item 28 
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Nuclear Reactors, Materials, and Waste Sector 

5. May 26, Wicked Local Plymouth - (Massachusetts) Pilgrim nuclear plant back to full 
power after refueling. Entergy Corporation officials reported that the Pilgrim Nuclear 
Power Station in Plymouth returned to full power May 26 following a scheduled $70 
million, 35-day refueling and maintenance project and a manual shut down May 22 
after crews found a condenser issue while starting the plant’s turbine generator. 

Source: http://plvmouth.wickedlocal.com/article/20150526/NEWS/150527558 

6. May 26, MarketWatch - (Pennsylvania) Unit 2 at Susquehanna nuclear plant 
returns to service. Pennsylvania Power and Light Corporation officials reported that 
the Susquehanna Steam Electric Station’s Unit 2 reactor in Berwick resumed full power 
May 25 following a scheduled refueling and maintenance outage in which crews 
replaced approximately 40 percent of the unit’s fuel and installed over 200 new turbine 
blades, and replaced a 24-ton pump and motor that circulates water through the plant’s 
reactor. 

Source: http://www.marketwatch.com/storv/unit-2-at-susquehanna-nuclear-plant- 
returns-to-service-201 5-05-26 

7. May 22, Peekskill-Cortlandt Patch - (New York) Indian Point transformer fire sent 
3,000 gallons of dielectric fluid into the Hudson. The U.S. Coast Guard and National 
Oceanic and Atmospheric Administration estimated May 22 that about 3,000 gallons of 
dielectric fluid was released into the Hudson River following a transformer explosion at 
Indian Point Energy Center’s Unit 3 in Buchanan May 9. The plant’s Unit 2 reactor is 
operating at full power while crews work to replace the transformer and investigate the 
cause of the failure. 

Source: http://patch.com/new-york/peekskill/indian-point-transformer-fire-cleanup- 
continues 



For another story, see item 28 
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Critical Manufacturing Sector 

8. May 23, Associated Press - (National) About 162,000 U-Haul trailer hitches being 
recalled; weak steal raises risk of breaking. Wisconsin-based Curt Manufacturing 
issued a recall May 23 for about 162,000 trailer hitches sold at U-Haul stores and 
online from 2014-2015 due to weak steel that could cause the parts to break. No 
injuries or damage have been reported in connection to the issue. 

Source: http://www.usnews.com/news/business/articles/2015/05/23/about-162-00Q-u- 
haul-vehicle-trailer-hitches-recalled 
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9. May 22, U.S. Department of Labor - (Oklahoma) Alfa Laval faces nearly $500k in 



fines for Oklahoma safety violations. The Occupational Safety and Health 
Administration cited Alfa Laval Inc., for 5 repeated and 45 serious violations May 22 
after inspections revealed inadequate protection of workers from machinery, 
insufficient respiratory equipment and training for hazardous chemicals, and no 
procedure to prevent machines from starting during maintenance or service, among 
other issues. Proposed penalties total $477,900. 

Source: 

https://www.osha.gov/pls/oshaweb/owadisp.show document?p table=NEWS RELEA 
SES&p id=28032 

For another story, see item 28 
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Defense Industrial Base Sector 

Nothing to report 
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Financial Services Sector 



10. May 26, U.S. Securities and Exchange Commission - (International) SEC Charges 
Deutsche Bank with misstating financial reports during financial crisis. The U.S. 
Securities and Exchange Commission (SEC) reported May 26 that Deustche Bank AG 
agreed to pay $55 million to settle charges that the bank allegedly filed misstated 
financial reports during the financial crisis that discounted material gap risks for 
potential losses estimated to be in the billions of dollars. The SEC also ordered the 
bank to avoid committing similar violations in the future. 

Source: http://www.sec.gov/news/pressrelease/2015-99.html 



[ Return to top ] 

Transportation Systems Sector 

1 1 . May 26, USA Today - (Texas; Oklahoma) At least 2 dead after flooding leaves 
Houston under water. The Governor of Texas declared disasters in 37 counties after 
major flooding and high waters followed severe storms in Southeast Texas May 25 to 
May 26, leaving most major highways impassible, hundreds of homes destroyed, and 4 
people in Texas and 2 others in Oklahoma dead. 

Source: http://www.usatodav.com/storv/weather/2015/05/26/extreme-weather-texas- 
oklahoma/27945961/ 

12. May 26, Detroit News - (Michigan) 1-375 to close after fire; tanker truck driver 
cited. The Interstate 75 northbound ramp at Interstate 375 in Detroit will be closed until 
May 29 and 1-375 from Jefferson to Mack will be closed until May 27 while crews 
repair damaged concrete and barriers on the ramp after a semi-truck hauling 



- 4 - 



approximately 9,000 gallons of unleaded gasoline overturned and caught fire May 24, 
resulting in a multiple -hour traffic jam. No injuries were reported. 

Source: http://www.detroitnews.com/storv/news/local/detroit-city/2015/05/26/truck- 
driver-tanker-fire-cited-careless-driving/27953259/ 

13. May 25, Orlando News 13 - (Florida) 1 killed, 8 injured after SUV overturns in 
Ormond Beach. State Road 40 in Volusia County reopened May 25 after being closed 
for approximately 5 hours after a vehicle lost control and crashed into the westbound 
lanes, killing 1 person and injuring 8 others. 

Source: 

http://www.mvnewsl3.com/content/news/cfnewsl3/news/article.html/content/news/arti 
cles/cfn/20 15/5/25/ormond beach crash.html 



14. May 24, WFAA 8 Dallas-Fort Worth - (Texas) Multi-vehicle wreck in Rowlett leaves 
one dead. Eastbound lanes of Interstate 30 in Rowlett were closed overnight May 23 to 
May 24 while crews cleared the scene of a multi- vehicle accident that killed at least 1 
person and injured several others. Authorities are investigating the weather-related 
incident. 

Source: http://www.wfaa.com/story/news/local/2015/05/23/accident-shuts-down-i-30- 
in-rowlett/27864625/ 



15. May 23, WHO 13 Des Moines - (Iowa) Union Pacific train derails in Belle Plaine. A 
Union Pacific train headed from Nebraska to Illinois hauling animal feed, lumber, 
frozen fish, and grain, derailed 23 of its 125 cars in Belle Plaine May 22. No injuries 
were reported and the cause of the derailment remains under investigation. 

Source: http://whotv.com/2015/05/23/union-pacific-train-derails-in-belle-plaine/ 
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Food and Agriculture Sector 

16. May 22, U.S. Department of Agriculture - (National) Culinary Brands Inc. recalls 
pork products due to misbranding and undeclared allergen. The U.S. Department 
of Agriculture announced May 22 that Culinary Brands Inc., in Vernon, California is 
recalling approximately 4,038 pounds of its 9-ounce “Simply Balanced Pork Chile 
Verde” products due to misbranding and an undeclared wheat allergen after receiving a 
customer complaint of erroneous product. The pork product was produced March 30 
and April 2, and shipped to retail stores nationwide. 

Source: http://www.fsis.usda.gov/wps/portal/fsis/topics/recalls-and-public-health- 
alerts/recall-case-archive/archive/2015/recall-083-2015-release 



17. May 22, Salem Capital Press - (California) High winds whip fires at ag byproducts 
plant. A May 17 fire at Agra Marketing LLC in Tracy, California was extinguished 
May 23 after fire crews remained on site for multiple days and exhausted more than 
50,000 gallons of water to contain the fire. The plant sustained 40-acres of damage 
with no reports of injuries. 

Source: http://www.capitalpress.com/Califomia/2015Q522/high-winds-whip-fires-at- 
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ag-byproducts-plant 
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Water and Wastewater Systems Sector 

18. May 26, KTRE 9 Lufkin - (Texas) Boil water notice for Gum Creek Water supply 
customers. Officials issued a two-minute boil advisory for all customers of Gum Creek 
Water Supply in Jacksonville, Texas, following a weather-related water outage May 26. 
Source: http://www.ktre.com/storv/29154236/boil-water-notice-for-customers-of-gum- 
creek-water-supply-in-jacksonville-area 

19. May 25, Associated Press - (Montana) New Butte water treatment plant uses 
innovative system. A new water treatment plant is opening December 2016 in Butte, 
Montana, that will be the first plant in the nation to treat its drinking water with 
Japanese and European-inspired ceramic membrane utilizing a pressurized system to 
push the water through the membranes and instead of pumps. 

Source: http://www.bozemandailychronicle.com/ap news/montana/new-butte-water- 
treatment-plant-uses-innovative-system/article 3519d72b-lb05-5895-ab94- 
da46a7048fb4.html 



For additional stories, see items 2, 7, 11, and 28 
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Healthcare and Public Health Sector 

20. May 26, Pittsburgh Business Times - (Pennsylvania) Jefferson Hospital warns about 
800 patients of data breach. The Jefferson Hospital in Philadelphia notified over 800 
people treated at its emergency department that their personal information, including 
Social Security numbers, may have been compromised by a former Medical 
Management LLC call center employee that copied personal information from the 
billing system over the past 2 years and disclosed it to an unauthorized third party. 
Source: http://www.biziournals.com/pittsburgh/blog/morning- 
edition/2015/05/iefferson-hospital-wams-about-800-patients-of.html 

21. May 25, Elkhart Truth - (Indiana) Beacon Health System target of phishing attack. 
South Bend-based Beacon Health System, servicing Elkhart General Hospital and 
Memorial Hospital of South Bend, notified patients of a security breach in which 
phishing attacks had compromised employee emails containing patient information 
such as Social Security and driver’s license numbers, and that certain email accounts 
were accessed as early as November 2013. The investigation is ongoing and Beacon is 
offering affected patients a free year of identity theft and credit monitoring and 
restoration services. 

Source: http://www.elkharttruth.com/living/Health/2015/05/25/Beacon-Health-Svstem- 
target-of-phishing-security-attack.html 
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22. May 22, Detroit Free Press - (Michigan) Birmingham doc admits to $11M fraud for 
unneeded surgeries. A neurosurgeon in Birmingham, Michigan pleaded guilty May 22 
to charges that he unlawfully billed government and private insurance companies $11 
million for unnecessary spinal surgeries on patients, and for an illegal kickback scheme 
in which a company he was involved with allegedly paid surgeons based on the volume 
and complexity of surgeries they performed and the number of spinal implant devices 
that hospitals bought from the company. 

Source: http://www.freep.com/storv/news/local/michigan/oakland/2015/05/22/spine- 
surgeon-pleads-guilty/27809373/ 

23. May 22, WHEC 10 Rochester - (New York) URMC: Nurse took patient info to new 
employer. The University of Rochester Medical Center (URMC) notified 3,403 
neurology department patients May 22 that a former nurse practitioner shared patients’ 
personal information around another neurology practice in early April without URMC 
and patient consent. The neurology practice has returned all personal information to 
URMC and assured that no information was leaked to a third party. 

Source: http://www.democratandchronicle.com/storv/news/2015/05/22/urmc-patient- 
information-breached/27 799845/ 



For another story, see item 29 
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Government Facilities Sector 

See items 11 and 29 
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Emergency Services Sector 

See item 29 
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Information Technology Sector 

24. May 26, Softpedia - (International) Apache HBase fixes denial-of-service, info 
disclosure flaw. Apache released a fix for a vulnerability in its HBase software in 
which a remote attacker with network access could create a denial-of-service (DoS) 
condition and read sensitive information by exploiting insecure Access Control Lists 
(ACLs) on the ZooKeeper quorum. 

Source: http://news.softpedia.com/news/Apache-HBase-Fixes-Denial-of-Service-Info- 
Disclosure-Flaw-482304.shtml 

25. May 26, Securityweek - (International) Synology fixes XSS, command injection 
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vulnerabilities in NAS software. Taiwan-based Synology released software updates 
addressing security vulnerabilities in DiskStation Manager (DSM) network attached 
storage (NAS) software that runs on the company’s DiskStation and RackStation 
devices, including a cross-site scripting (XSS) bug that could allow attackers to steal 
victims session tokens and login credentials or perform arbitrary actions, and a 
command injection flaw that exposes devices to cross-site request forgery (CSRF) 
attacks. 

Source: http://www.securitvweek.com/synologv-fixes-xss-command-iniection- 
vulnerabilities-nas-software 



26. May 26, Securityweek - (International) Massive campaign uses router exploit kit to 
change routers’ DNS servers. A security researcher discovered an active campaign in 
which attackers are targeting Google Chrome browser users with cross-site request 
forgery (CSRF) code attacks via compromised Web sites with the intent of 
compromising routers and changing their domain name system (DNS) settings to point 
to a hacker-controlled server. Researchers believe that millions of devices across 55 
router models made by several manufacturers have been affected in the campaign. 
Source: http://www.net-security.org/secworld.php ?id=l 8424 

27. May 25, Securityweek - (International) New PoS malware hits victims via spam 
campaign: FireEye. Security researchers at FireEye discovered a new type of point-of- 
sale (PoS) malware dubbed NitlovePoS that can capture and exfiltrate both track one 
and two data from payment cards by running process on compromised machines, and is 
distributed via emails containing Word documents with embedded malicious macros. 
Source: http://www.securitvweek.com/new-pos-malware-hits-victims-spam-camapign- 
fireeye 



28. May 22, Securityweek - (International) Emerson patches SQL injection vulnerability 
in ICS product. Emerson’s Process Management group released a software addressing 
a structured query language (SQL) injection vulnerability in its AMS Device Manager 
in which an attacker could escalate privileges and gain access to administrative 
functions by supplying a malformed input to the software. The AMS Device Manager 
is part of the AMS Suite and is used in many industrial control systems (ICS) 
worldwide, especially in the oil, gas, and chemical industries. 

Source: http://www.securitvweek.com/emerson-patches-sql-iniection-vulnerability-ics- 
product 



Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 
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Communications Sector 



29. May 25, Springfield Republican - (Massachusetts) Boston water main break disrupts 
telecommunication services for thousands throughout Massachusetts. A 
Windstream spokesperson reported May 25 that Internet and telephone services were 
restored after a water main break in Boston flooded critical equipment that caused an 
outage for approximately 10,000 customers and impacted telephone service at Mount 
Holyoke College, Tufts Medical Center, and Beth Israel Deaconess Medical Center. 
Police reported 911 services are still operational for emergencies. 

Source: 

http://www.masslive.com/news/index.ssf/2015/05/boston water main break disrup.ht 
ml 

30. May 25, AccuWeather - (Oklahoma; Arkansas) NOAA weather radio outages 
restored in Oklahoma; radar data challenges persist. The National Oceanic and 
Atmospheric Administration’s weather radios service was restored throughout 
Oklahoma May 25 after a cable line issue caused an outage May 24, but the National 
Weather Service (NWS) in Norman reported that Level II radar data remains 
unavailable for radar sites in Tulsa, Oklahoma, and Fort Smith, Arkansas. The NWS 
continue to investigate the issue. 

Source: http://www.accuweather.com/en/weather-news/noaa-weather-radio-outages- 
rep/47644891 
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Commercial Facilities Sector 

3 1 . May 26, Associated Press - (Michigan) Fire at apartment complex prompts 
evacuation of 16 units. A May 25 fire in Oakview Estates in New Buffalo Township, 
Michigan prompted the evacuation of 16 apartment units after the fire began in the 
kitchen and spread throughout the apartment. Fire crews remained at the site for several 
hours and contained the fire to one unit while seven others suffered water and smoke 
damage. 

Source: http://www.washingtontimes.com/news/2015/mav/26/fire-at-apartrnent- 
complex-prompts-evacuation-of-16/ 

32. May 24, Cincinnati Enquirer - (Ohio) Power outage strands 6 riders at Coney 
Island. Coney Island amusement park in Ohio was shut down early May 24 after a 
large power outage in Anderson Township left 6 riders stuck on top of a roller coaster 
and more than 13,000 local residents without power. All customers were safely 
evacuated and the cause of the outage has not been disclosed. 

Source: http://www.cincinnati.com/storv/news/2015/05/24/1300Q-without-power-in- 
anderson-township/27895065/ 

33. May 23, KJRH 2 Tulsa - (Oklahoma) Broken Arrow Walmart evacuated due to 
bomb threat. A Walmart in Broken Arrow, Oklahoma reopened May 24 after a 
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suspicious box with the word “Boom” written on it was found in the men’s restroom at 
the front of the store, prompting the evacuation of a dozen employees May 23. Police 
cleared the site and an investigation to determine the culprit is ongoing 
Source: http://www.newslocker.com/en-us/news/wahirart/broken-arrow-wahnart- 
evacuated-due-to-bomb-threat-kirhcom/view/ 

For additional stories, see items 1 , 11 , and 27 
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Dams Sector 

For another story, see item 28 
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Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@hq.dhs.gov or (202) 282-9201. 

To report cyber infrastructure incidents or to request information, please contact US -CERT at soc@us-cert.gov or visit 
their Web page at www.us-cert.gov . 
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restrictions. DHS provides no warranty of ownership of the copyright, or accuracy with respect to the original source 
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